The apexomni-client package on PyPI contains malicious code that exfiltrates multiple sensitive environment variables during installation. It achieves this by overriding the install command in its setup.py script to execute unauthorized code. This behavior is part of a broader campaign involving dependency confusion and credential theft.